Firmware should be updated to the latest available version to ensure all security patches are applied.
Management networks (subnets/VLANs) should also be separated by firewalls, and access should be limited (via ACLs and other methods) to authorized server administrators.
If you choose not to use IPMI the DRAC/iDRAC IPMI firewall should be enabled, and IPMI over the network should be disabled. (Control available via the iDRAC web interface and the iDRAC CLI).
IPMI Over Lan is disabled by default on all Dell 8G Servers and later, including our currently shipping 12G models.
Disable Cipher 0 - Cipher 0 is an option usually enabled by default, that can allow authentication to be bypassed. Disabling Cipher 0 can prevent attackers from bypassing authentication and sending arbitrary IPMI commands.
ipmitool lan set 1 cipher_privs Xaaaaaaaaaaaaaa
The syntax for the cipher suites will vary by customer needs. The initial X disabled cipher suite 0. In the example above, all remaining cipher suites would be available to ADMIN users.
Quick Tips content is self-published by the Dell Support Professionals who resolve issues daily. In order to achieve a speedy publication, Quick Tips may represent only partial solutions or work-arounds that are still in development or pending further proof of successfully resolving an issue. As such Quick Tips have not been reviewed, validated or approved by Dell and should be used with appropriate caution. Dell shall not be liable for any loss, including but not limited to loss of data, loss of profit or loss of revenue, which customers may incur by following any procedure or advice set out in the Quick Tips.
Article ID: SLN156429
Last Date Modified: 06/23/2014 07:59 AM
Rate this article
Easy to understand
Was this article helpful?
Send us feedback
Feedback shows invalid character, not accepted special characters are <> () \
Sorry, our feedback system is currently down. Please try again later.
Thank you. Your feedback has been sent.
Feature not supported by browser
FireFox does not support this feature with a secure connection(https). For the best experience, we recommend using Internet Explorer or Chrome.